Is CVE-2026-77063 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77063 being exploited in the wild.

How severe is CVE-2026-77063?

Low severity, with a CVSS score of 3.7, published 28 August 2026.

Which products and versions are affected?

multer (npm) SEMVER:introduced=0,fixed=2.3.0.

Is there a fix for CVE-2026-77063?

Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77063 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77063?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77063: multer file size limit bypass via async fileFilter race condition

CVE-2026-77063 · Severity: low · CVSS 3.7 · Published 2026-08-28

Multer is a widely-used Node.js middleware for handling file uploads in web applications. When configured with asynchronous file filtering, the file size limit can be bypassed, allowing oversized files to be uploaded and accepted. An attacker could exploit this to bypass upload restrictions, potentially leading to disk exhaustion, denial of service, or uploading malicious files that should have been rejected.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2026-77063 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77063 being exploited in the wild.
How severe is CVE-2026-77063?: Low severity, with a CVSS score of 3.7, published 28 August 2026.
Which products and versions are affected?: multer (npm) SEMVER:introduced=0,fixed=2.3.0.
Is there a fix for CVE-2026-77063?: Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77063 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77063?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.3.0 or later
```
npm install multer@2.3.0
```

Technical details

The vulnerability is a race condition (CWE-362) in multer's file upload handling when an asynchronous fileFilter is configured. The root cause is that the 'limit' event listener, which enforces the limits.fileSize restriction, is registered inside the async fileFilter callback. If a file exceeds limits.fileSize before the callback executes, the size-check event is never registered, causing the oversized file to be accepted instead of triggering a LIMIT_FILE_SIZE error. This affects all upload methods (.single(), .array(), .fields(), .any()). Applications using synchronous fileFilter functions are not affected. The vulnerability requires an attacker to upload files via the web interface but no authentication or special privileges. A patch is available in version 2.3.0; workarounds include switching to synchronous fileFilter or validating file size after upload completes.

Affected products

expressjs multer < 2.3.0

Identifiers

CVE-2026-77063
GHSA-qvfw-j98x-7q72

Timeline

2026-08-28: disclosed: Vulnerability published by NVD
2026-09-08: advisory: GitHub Advisory Database review and publication
2026-09-08: patched: Version 2.3.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.